Re: [PATCH v3 3/6] wifi: mwifiex: fix OOB read from firmware sta_count in station list response

[Brian Norris <briannorris@chromium.org>]

On Tue, Apr 21, 2026 at 01:49:35PM +0000, Tristan Madani wrote:
> From: Tristan Madani <tristan@talencesecurity.com>
> 
> The firmware-controlled sta_count (u16) is used as an unbounded loop
> counter for iterating station info entries. An inflated count drives
> reads past the response buffer into kernel heap memory.
> 
> Add a check that sta_count fits within the response size.
> 
> Fixes: b21783e94e20 ("mwifiex: add sta_list firmware command")
> Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
> ---
> Changes in v3:
>   - Regenerated from wireless-next with proper git format-patch to
>     produce valid index hashes (v2 had post-processed index lines).
> 
> Changes in v2:
>   - No code changes from v1.
> 
>  drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c | 10 +++++++++-
>  1 file changed, 9 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c b/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
> index 85512f526c5f2..4cf654046c6ae 100644
> --- a/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
> +++ b/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
> @@ -976,8 +976,16 @@ static int mwifiex_ret_uap_sta_list(struct mwifiex_private *priv,
>  	struct mwifiex_ie_types_sta_info *sta_info = (void *)&sta_list->tlv;
>  	int i;
>  	struct mwifiex_sta_node *sta_node;
> +	u16 resp_size = le16_to_cpu(resp->size);
> +	u16 count = le16_to_cpu(sta_list->sta_count);
> +	u16 max_count;
>  
> -	for (i = 0; i < (le16_to_cpu(sta_list->sta_count)); i++) {
> +	if (resp_size < sizeof(*resp) - sizeof(resp->params) + sizeof(*sta_list))
> +		return -EINVAL;
> +	max_count = (resp_size - sizeof(*resp) + sizeof(resp->params) -
> +		     sizeof(*sta_list)) / sizeof(*sta_info);

The repeated arithmetic is a bit weird, but I'm not sure if it'd
actually be better to stash it in its own variable. Seems good enough I
suppose.

Acked-by: Brian Norris <briannorris@chromium.org>

> +	count = min(count, max_count);
> +	for (i = 0; i < count; i++) {
>  		sta_node = mwifiex_get_sta_entry(priv, sta_info->mac);
>  		if (unlikely(!sta_node))
>  			continue;
> -- 
> 2.47.3
>